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REMARKS 

Applicant has carefully studied the outstanding Office Action in the present 
application. The present response is intended to be fully responsive to all points of 
rejection raised by the Examiner and is believed to place the application in condition for 
allowance. Favorable reconsideration and allowance of the application are respectfully 
requested. 

Application as examined included claims 1-88, 113-147, 172-206 and 231-243. 
Claims 89-1 12, 148-171 and 207-230 are withdrawn. Claims 1, 23, 45, 67, 126 and 185 are 
amended. Claims 2-22, 24-44, 46-66, 68-88, 113-125, 127-147, 172-184, 186-206 and 231- 
243 are unchanged. 

The abstract of the disclosure is objected to by the Examiner as failing to 
sufficiently describe the disclosed invention. Applicant has amended the abstract to 
overcome this objection. 

Claims 1-14, 17-36, 39-44, 67-80, 83-88, 126-139 and 142-147 stand rejected 
under 35 U.S.C. 102(b) as being anticipated by Curtis ("Top 10 Tips for Avoiding 
Viruses"). 

Claims 1-14, 17-22, 67-80 and 83-88 stand rejected under 35 U.S.C. 102(e) as 
being anticipated by Le Pennec et al (US Patent Application Publication 2001/0020272). 

Claims 23-36, 39-40, 44, 126-139, 142-143, 147 and 172-184 stand rejected 
under 35 U.S.C. 102(e) as being anticipated by Stewart et al (US Patent No. 6,901,519). 

Claims 15-16, 37-38, 45-66, 81-82, 140-141 and 185-206 stand rejected under 
35 U.S.C. 103(a) as being unpatentable over Curtis. Claims 15-16, 45-66, 81-82 and 185- 
206 stand rejected under 35 U.S.C. 103(a) as being unpatentable over Le Pennec. 

Claims 113-125, 172-184 and 231-243 stand rejected under 35 U.S.C. 103(a) as 
being unpatentable over Curtis and further in view of Touboul et al (US Patent No. 
6,154,844). Claims 113-125 and 231-243 stand rejected under 35 U.S.C. 103(a) as being 
unpatentable over Le Pennec and further in view of Touboul et al (US Patent No. 
6,154,844). 
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Claims 37-38 and 140-141 stand rejected under 35 U.S.C. 103(a) as being 
unpatentable over Stewart. Claims 41-43 and 144-146 stand rejected under 35 U.S.C. 
103(a) as being unpatentable over Stewart and further in view of Pasawicz ("The 
Importance of File Extensions"). 

Curtis describes methods for avoiding viruses. Le Pennec describes a method 
and system for caching virus-free file certificates. Stewart describes an e-mail virus 
protection system including a sacrificial server. 

Touboul describes a system and method for attaching a downloadable security 
profile to a downloadable, the system including an inspector and a protection engine. 
Pasawicz describes the use of file extensions and the potential damage that can result from 
not understanding their usage. 

Applicant has amended independent claims 1, 45, 67 and 185 to more clearly 
define the novel features of the present invention and to include the recitation "examining, 
using computerized functionality, at least two different corresponding characteristics of a 
digital object" and "said at least two different corresponding characteristics being 
detectible using computerized functionality and being examined at the same point in time." 

Support for the amendment to the claims is found, inter alia, in Figs. 6A-6C and 
the description thereof in paragraphs 59-65 of the application as filed. Additional support 
can be found in paragraph 1 of the application as filed. 

Applicant has similarly amended claims 23 and 126 to recite "obtaining 
information, using computerized functionality, relating to at least two different 
corresponding characteristics of a digital object" and "said at least two different 
corresponding characteristics being detectible using computerized functionality and being 
examined at the same point in time." 

Applicant respectfully submits that Curtis describes manual methods for 
avoiding computer viruses. Curtis suggests that a recipient manually look for an 
unexpected file extension on any attachment. In the passage cited by the examiner, Curtis 
writes: 
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If the subject line or the body of an e-mail states that the attachment is a 
certain type of file or if the file icon implies a certain type of file and the file 
extension does not match, delete the file. If you trust the sender, contact that 
person to determine what you were supposed to have received. 
Applicant respectfully submits that the method of Curtis includes a user 
scanning the subject line or body of an email to determine a file type or if a file icon and a 
file extension do not match. Applicant respectfully submits that Curtis does not show or 
suggest how to implement his method via a computerized machine, and furthermore, Curtis 
does not show or suggest the possibility of automating his method. Since the method of 
Curtis is suitable to be implemented relying on utilizing human intelligence and not by a 
computerized machine, and since Curtis does not provide any information concerning 
implementing his human-intelligence oriented method on a machine, a person of ordinary 
skill in the art would not be able to implement this method using computerized 
functionality, as recited in the amended claims. 

Furthermore, Applicant respectfully submits that a user manually scanning an 
email message cannot analyze information such as a file's header, since this information is 
not presented with the email content. Thus, there is a crucial difference between Curtis and 
the present invention - the criterions that Curtis suggests can be analyzed manually, while 
criterions of the present invention can be analyzed by computerized functionality. 

Additionally, Applicant notes that the Curtis reference is from a source whose 
date is self-reported and not independently verifiable. As such, the Applicant respectfully 
requests to understand how the Examiner is able to confirm 1) that the self-reported date is 
correct and that this reference is indeed prior art and 2) even if the self-reported date is 
correct, that the version currently available was not amended subsequent to the original 
self-reported date. 

Applicant respectfully submits that Le Pennec describes a method and system 
that utilizes a single characteristic of a file - its digital signature - examined at two different 
points in time. Le Pennec compares a digital signature of a file taken at a first point in time 
(A) with a digital signature of the same file taken at a second point in time (B). In contrast 
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to Le Pennec, the present invention, as recited in the amended claims, refers to obtaining 
and comparing at least two different corresponding characteristics being examined at the 
same point in time. 

Applicant respectfully submits that Stewart describes a system and method for 
disabling e-mail viruses by converting all files into non-executable code. In the passage 
cited by the Examiner, Stewart describes comparing individual characteristics of a file with 
a predetermined list provided by a user. Stewart does not show or suggest comparing two 
different corresponding characteristics for a mismatch therebetween. In contrast to Stewart, 
the present invention refers to obtaining information relating to at least two different 
corresponding characteristics of a digital object and analyzing the information relating to 
the at least two different corresponding characteristics for mismatches therebetween. 

As recited in the amended claims, the system and method of the present 
invention examine at least two different corresponding characteristics of a digital object, 
such as the file type and the file extension. Thus, if a file type, as indicated by the file 
header, is executable, but the file extension is "JPG", i.e. a multimedia file, the file is 
suspicious. The present invention thus compares two different corresponding 
characteristics to determine if a mismatch exists between the two characteristics. 

Applicant respectfully submits that none of the prior art, either alone or in 
combination, shows or suggests the novel and non-obvious features of the system and 
method of the present invention, including examining two different corresponding 
characteristics at the same point in time using computerized functionality. 

Applicant respectfully submits that none of the prior art, either alone or in 
combination, shows or suggests a method of detecting malicious content including, inter 
alia, examining, using computerized functionality, at least two different corresponding 
characteristics of a digital object, said at least two different corresponding characteristics 
being detectible using computerized functionality and_being examined at the same point in 
time, as recited in amended claims 1 and 45. Applicant respectfully submits that none of 
the prior art, either alone or in combination, shows or suggests a system for detecting 
malicious content including, inter alia, a digital object examiner, examining, using 
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computerized functionality, at least two different corresponding characteristics of a digital 
object, said at least two different corresponding characteristics being detectible using 
computerized functionality and_being examined at the same point in time, as recited in 
amended claims 67 and 185. 

Applicant respectfully submits that none of the prior art, either alone or in 
combination, shows or suggests a method of detecting malicious content including, inter 
alia, obtaining information, using computerized functionality, relating to at least two 
different corresponding characteristics of a digital object, the at least two different 
corresponding characteristics being detectible using computerized functionality and_being 
examined at the same point in time to obtain the information, analyzing the information, 
using computerized functionality, to categorize the digital object into at least two 
categories and comparing, using computerized functionality, the at least two categories to 
decide whether there exists a mismatch therebetween, as recited in amended claim 23. 
Applicant respectfully submits that none of the prior art, either alone or in combination, 
shows or suggests a system for detecting malicious content including, inter alia, a digital 
object information obtainer, obtaining information, using computerized functionality, 
related to at least two different corresponding characteristics of a digital object, the at least 
two different corresponding characteristics being detectible using computerized 
functionality and being examined at the same point in time, a characteristic based 
categorizer, categorizing the information, using computerized functionality, into at least 
two categories and a categories mismatch detector, analyzing, using computerized 
functionality, the at least two categories to determine whether there exists a mismatch 
therebetween, as recited in amended claim 126. 

Applicant respectfully submits that independent claims 1, 23, 45, 67, 126 and 
185 are therefore patentable. All of the claims depend directly or ultimately from one of 
claims 1, 23, 45, 67, 126 and 185 and recite additional patentable matter and are therefore 
deemed allowable. 
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In view of the foregoing, all of the claims are deemed to be allowable. 
Favorable reconsideration and allowance of the application are respectfully requested. 



Dated: June 12, 2006 



ubmitted, 
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